[wp-trac] [WordPress Trac] #40459: WP_Site::__set() and WP_Network::__set() allow to set any property without a way to retrieve it

[WordPress Trac]

#40459: WP_Site::__set() and WP_Network::__set() allow to set any property without
a way to retrieve it
--------------------------------+-----------------------------
 Reporter:  ocean90             |       Owner:
     Type:  enhancement         |      Status:  new
 Priority:  low                 |   Milestone:  Future Release
Component:  Networks and Sites  |     Version:  4.6
 Severity:  normal              |  Resolution:
 Keywords:  has-patch           |     Focuses:  multisite
--------------------------------+-----------------------------
Changes (by MaximeCulea):

 * type:  defect (bug) => enhancement


Comment:

 Hi @bor0,
 We talked about this issue in the ticket-scrub.

 By default, as a `__set()` method hasn't been created, when you set a non-
 existing property, it becomes public, so it can be accessed afterwards.

 So now, as it hasn't been "block" in `WP_Post`, because `WP_Post::__set()`
 doesn't exists, the question is why we would implement it for `WP_Site`
 and `WP_Network` ?

 Moreover and more generally, what did you expect about blocking non-
 existing property creation ?

 Patch avenue :
 If we wanna digg into this, we would have to remove the `$this->$key =
 $value` in the `__set()` method.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/40459#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform